Expanded automatic auditing support for AD CS, AD FS, and Entra Connect servers
Analysis / inference: Defender for Identity sensor v3.x introduces automatic Windows event auditing configuration for AD CS, AD FS, and Microsoft Entra Connect servers.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Defender for Identity - What's new · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Defender for Identity automatic Windows event auditing has been expanded to configure auditing natively on eligible AD CS, AD FS, and Microsoft Entra Connect servers running sensor version 3.x.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisAutomatic event log auditing configuration ensures necessary security telemetry is captured on critical identity infrastructure without manual administration.
Reduces manual administrative overhead by automatically ensuring that crucial Windows events are audited on auxiliary identity infrastructure servers.
Section 03 · Recommended actions
- Ensure Defender for Identity sensors are updated to v3.x on all AD CS, AD FS, and Microsoft Entra Connect servers
- Review the official configuration guide to verify automatic Windows event collection settings
- Verify that Defender for Identity sensor version 3.x is installed on AD CS, AD FS, and Microsoft Entra Connect servers
- Check that automatic Windows event auditing is successfully applying the required policies on non-domain controller servers